🚨LiteLLM Malware Compromises 23M Weekly Downloads
Your AI credentials are at risk
TL;DR
LiteLLM, a popular LLM interface, was compromised with malware stealing cloud and AI credentials. The malicious version was quickly quarantined, but anyone who used it should assume their secrets are compromised.
LiteLLM, a widely-used library for interacting with LLM providers, was hit by a supply chain attack. The malware, uploaded to PyPI and Docker registries, steals cloud and AI credentials and installs a remote access trojan. PyPI and Docker quickly quarantined the malicious version, but anyone who used it should assume their secrets are compromised. LiteLLM sees 23 million weekly downloads, making this a significant security issue for developers and teams relying on it. The malware targets 16 modules, including browsers, cloud providers, and AI services.
Key Points
Malware uploaded to PyPI and Docker registries at 11:39 UTC.
LiteLLM sees 23 million weekly downloads, making this a major security issue.
Malware includes three files: cook.pth, cook.py, and sitecustomize.py.
Infostealer module targets 16 modules, including browsers and cloud providers.
Malware encrypts stolen data and sends it to an attacker-controlled domain.
Why It Matters
If you're using LiteLLM, your cloud and AI credentials are at risk. The malware targets 16 modules, including browsers and cloud providers, making it a significant threat for anyone relying on LiteLLM. Developers and teams should immediately check their systems and update to the latest safe version, v1.106.2.
Comments
Be the first to comment
Enjoyed this article?
Get it daily. 7am. Free. Reads in 5 minutes.
Join 3,569 builders reading daily.